Kuntek supplies OT security solution Claroty
Preparation for the revision of the evaluation standards for information and communication control systems
Conducted OT security training for ICS security personnel


Security incidents involving industrial control systems (ICS), such as those in manufacturing facilities, power plants, and factories, have been on the rise since 2012. Representative examples include the malware infection of a German steel company's blast furnace control system in late 2014, a cyber attack on a Ukrainian power plant in 2015, and the hacking of an Indian nuclear power plant in 2019.

In response, the Ministry of Science, ICT and Future Planning (currently the Ministry of Science and ICT) announced the 'Criteria for Vulnerability Analysis and Evaluation of Major Information and Communication Infrastructure' in 2013, but there were limitations in properly conducting ICS security evaluations, and additional improvements to vulnerability analysis and evaluation items suitable for the latest recovery response are scheduled to be announced.

On the 4th, Kuntek announced that it would provide a 'security environment evaluation support service' to help prepare for the revision of the evaluation standards for critical information and communications infrastructure control systems through the supply of its global OT (Operational Technology) security solution, 'Claroty'. In addition, we plan to conduct specialized OT security training for ICS security personnel.

The most critical consideration in ICS and OT security is network access control. To achieve this, the control network must be periodically inspected, external network connections via wireless internet or tethering restricted, and access by unauthorized systems or devices blocked. However, proper management is impossible without ensuring visibility into the entire network.

Claroty identifies and catalogs operational asset information through mirrored traffic on ICS/OT networks to secure visibility into the entire network. This enables the identification of network structure and flow, as well as the monitoring of asset fluctuations and the activities of attackers and insiders, thereby allowing for a response to security threats.

By utilizing Active Mode, various firmware and software installed in the control system can be kept up to date, and visibility into security patches can be secured through the use of secure queries. This enables the verification of patch and update files imported from external vendors or internet downloads, as well as the performance of malware scans.

By utilizing the attack simulation function, virtual attack routines based on vulnerabilities in control system assets and components can be identified, enabling the establishment of crisis response manuals.